Blog / security monday
Nothing is broken: why you still need updates
Most hacked sites we clean up were running software with a known, already-patched hole, so here is how to update without fear of breaking things.
This edition of Security Monday is about the sentence we hear more than any other: "The site works fine, so I don't want to touch it."
We understand the instinct. Updates occasionally break things, and a working site paying its way feels like something to leave alone. But from where we sit, on the server side, that instinct is responsible for more hacked sites than everything else combined.
Hacks are mostly old news
Here is the part that surprises people. The compromises we clean up are almost never clever. They exploit vulnerabilities that were discovered, publicly documented and patched months or sometimes years before the attack. The fix existed. It was free. It just was not installed.
This is the economics of automated attacks. Nobody spends effort finding new holes in your bakery's website. Instead, scripts scan millions of sites for the specific plugin versions with known holes, because a published vulnerability plus a slow-updating public is a reliable harvest. When a serious plugin flaw is announced, we watch the probing traffic for it appear in our logs within a day or two. It then continues for years, because it keeps working.
So "nothing is broken" is the wrong test. From the outside, a site running a vulnerable plugin looks exactly like a healthy one, right up until it doesn't.
Why "it works, don't touch it" logic fails on the web
The don't-touch rule is decent advice for a machine in a closed room. Your website is not in a closed room. It is a public endpoint, reachable by every scanner on the internet, running software whose flaws are published on a schedule you do not control.
That means standing still is not a neutral choice. Each month without updates, the list of documented ways into your stack only grows. The site is not staying the same. Relative to the people probing it, it is getting softer.
Updating without fear
The fear of updates is really a fear of having no way back. Fix that, and the fear mostly goes away. Here is the routine we suggest, and use ourselves:
First, back up before you update. A copy of the files and database taken right before you press the button turns a broken update from a crisis into a ten-minute rollback.
Second, stage the risk. Let WordPress apply minor core releases automatically; they are overwhelmingly safe. For plugins, update the boring, well-maintained ones freely. For the one or two plugins your business genuinely depends on, read the changelog and update them when you have twenty minutes to check the site afterward, not at 5 p.m. on a Friday.
Third, actually look at the site after updating. Load the front page, the contact form, the checkout if you have one. Most update breakage is visible within two minutes if anyone looks.
If you run a site where downtime is real money, keep a copy of it under a subdomain or on a cloud server and rehearse updates there first. That is what staging means, and it does not require anything fancy.
The exception that proves the rule
Occasionally an update really does break something, and people remember that one afternoon forever while forgetting the hundreds of uneventful updates around it. Fair enough. But compare the two failure modes. A bad update is visible immediately, affects a known change you can undo, and your backup takes you straight back. A compromise through an unpatched hole is invisible for weeks, has no obvious undo, and usually costs far more hours to clean up than a year of routine updating.
We covered the wider habit set in our five security basics, and updates were first on that list for a reason. It is the habit with the best ratio of effort to disaster prevented.
Make it boring
The goal is for updates to be a dull weekly chore: back up, update, click around, done. Boring is what success looks like in this line of work.
If an update has left your site in a bad state and you host with us, our support team can pull the pre-update backup and help you sort it out.